This is a note to let you know that I've just added the patch titled Bluetooth: Fix race condition with user channel and setup stage to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 781f899f2f9d8b71e35225a087f90052059486c5 Mon Sep 17 00:00:00 2001 From: Marcel Holtmann <marcel@xxxxxxxxxxxx> Date: Sat, 6 Jun 2015 06:06:49 +0200 Subject: Bluetooth: Fix race condition with user channel and setup stage From: Marcel Holtmann <marcel@xxxxxxxxxxxx> commit 781f899f2f9d8b71e35225a087f90052059486c5 upstream. During the initial setup stage of a controller, the low-level transport is actually active. This means that HCI_UP is true. To avoid toggling the transport off and back on again for normal operation the kernel holds a grace period with HCI_AUTO_OFF that will turn the low-level transport off in case no user is present. The idea of the grace period is important to avoid having to initialize all of the controller twice. So legacy ioctl and the new management interface knows how to clear this grace period and then start normal operation. For the user channel operation this grace period has not been taken into account which results in the problem that HCI_UP and HCI_AUTO_OFF are set and the kernel will return EBUSY. However from a system point of view the controller is ready to be grabbed by either the ioctl, the management interface or the user channel. This patch brings the user channel to the same level as the other two entries for operating a controller. Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx> Signed-off-by: Johan Hedberg <johan.hedberg@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/bluetooth/hci_sock.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -741,10 +741,11 @@ static int hci_sock_bind(struct socket * goto done; } - if (test_bit(HCI_UP, &hdev->flags) || - test_bit(HCI_INIT, &hdev->flags) || + if (test_bit(HCI_INIT, &hdev->flags) || hci_dev_test_flag(hdev, HCI_SETUP) || - hci_dev_test_flag(hdev, HCI_CONFIG)) { + hci_dev_test_flag(hdev, HCI_CONFIG) || + (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && + test_bit(HCI_UP, &hdev->flags))) { err = -EBUSY; hci_dev_put(hdev); goto done; @@ -760,10 +761,21 @@ static int hci_sock_bind(struct socket * err = hci_dev_open(hdev->id); if (err) { - hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); - mgmt_index_added(hdev); - hci_dev_put(hdev); - goto done; + if (err == -EALREADY) { + /* In case the transport is already up and + * running, clear the error here. + * + * This can happen when opening an user + * channel and HCI_AUTO_OFF grace period + * is still active. + */ + err = 0; + } else { + hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); + mgmt_index_added(hdev); + hci_dev_put(hdev); + goto done; + } } atomic_inc(&hdev->promisc); Patches currently in stable-queue which might be from marcel@xxxxxxxxxxxx are queue-4.1/bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch queue-4.1/bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch queue-4.1/bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch queue-4.1/ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch queue-4.1/bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch queue-4.1/bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html